magento / magento/magento-coding-standard

Escaping for XML is caught by DiscouragedFunctionSniff

Open
#496 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
PHP
Stars
375
Forks
165
PR merge metrics
No merged PRs in 30d

Description

### Description
The following code ` htmlspecialchars($string, ENT_XML1, "UTF-8")` triggers the warning
```
38 | WARNING | The use of function htmlspecialchars() is discouraged; use
| | \Magento\Framework\Escaper->escapeHtml() instead
| | (Magento2.Functions.DiscouragedFunction.DiscouragedWithAlternative)
```

### Expected behavior
The suggested alternative is not an equivalent solution. A brief search over the Magento codebase also reveals there is no mention of `ENT_XML1`. Also `\Magento\Framework\Escaper::$htmlSpecialCharsFlag` is a private property making it impossible to set `ENT_XML1` in a custom implementation.

### Benefits
Ensure XML content can be generated correctly with-in a Magento module.

### Additional information
Solutions would be either to a.) ensure the discouraged function sniff only triggers in code that is covered by the alternative or b.) add options to escape for XML in `\Magento\Framework\Escaper`

Contributor guide

Open the contributing guide

Research direction

Start by reading the DiscouragedFunctionSniff behavior for htmlspecialchars() and the Magento\\Framework\\Escaper handling of $htmlSpecialCharsFlag. Compare the ENT_XML1 use case with the suggested escapeHtml() alternative and determine the intended scope of the sniff. Done means valid XML escaping is supported without an incorrect warning, with coverage for the chosen behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.